Ingeus UK are the lead partner in the Able Futures partnership, which delivers the Access to Work Mental Health Support Service.
Ingeus UK are fully committed to ensuring that we are transparent about how we process your personal information. The ‘processing’ of your personal information includes the collection, recording, storing, changing, sharing, general use, or destruction of your information
This Privacy Notice describes what data we collect, why we collect it, how we use it, how we keep it secure, and the conditions under which we share it. It also outlines you rights under the General Data Protection Regulation and Data Protection Act 2018.
This Notice may be updated periodically, in line with changes to our processing activities or legislative changes. All changes will be published on our website.
The Access to Work Mental Health Support programme (AtW MHSS) is delivered through the Access to Work programme – a Jobcentre Plus discretionary grant scheme, and is an essential element of the Department for Works and Pension’s (DWP) support to individuals with a mental health condition, to stay in work, or to move to more suitable work. The AtW MHSS programme provides support by assisting individuals to overcome work related obstacles.
The AtW MHSS also offers advice and guidance to employers on how best to support employees with a mental health condition or issue, and help resolve practical and organisational factors related to the work environment.
Ingeus UK Ltd is a company incorporated in England, registered at Companies House (04320853). In partnership with our Delivery Partners we deliver the AtW MHSSProgramme on behalf of the DWP. Our Delivery Partners are:
We collect and use information obtained from yourself or from an Access to Work referral, in order to provide the services described above.
By collecting information from you, Ingeus UK and our Delivery Partners can better identify your individual needs and how best to support you on the programme.
For the purposes of processing your data:
Ingeus UK Ltd process your information in order to provide you with the best possible support whilst on the programme, and to meet the requirements of our contracts and other legal obligations. We cannot process your information without having a valid, lawful reason for doing so. Key reasons for processing your information are described below, further details about the organisations we share with and the legal basis for processing can be found here.
The aim of this programme is to help you to remain in work or to move to more suitable employment. During your meetings, your VRC may feel that your GP/Health Practitioner, may not have the full picture about your condition, and may want to write to them so that they are better equipped with information to provide you with the support you need. With your consent, the VRC might contact your employer to discuss the obstacles you are experiencing, and provide guidance to them as to how they can support you.
We routinely share your personal data with the following organisations to update them on your progress, including whether you have completed the programme, achieved any key milestones or left early, or to provide additional support to you.
Ingeus UK cannot process your information without having a valid, lawful reason for doing so. For further details about the organisations we share with and the legal basis we have for sharing this data please click here.
Ingeus UK pride ourselves on continuously improving the services provided to you and others. We identify areas for improvement by conducting research and evaluating the effectiveness of our existing services. One way in which we do this is to convert your personal data into statistical or aggregated data, which is then used to produce statistical research and reports. This information is sometimes shared with the DWP and other research organisations, however, it cannot be used to identify you.
We sometimes commission other organisations to carry out research on our behalf. Where your personal data can be identified or we would like you to provide additional information, via focus groups or feedback forms, we will always ask your permission first.
Where we need your agreement to process your information, for example, contacting your employer, we will ask you to give your consent first. We will explain why your consent is needed and the information that we will share. This information will be provided verbally or or in written form. Where consent is given by you, this will be recorded on our systems for tracking and audit purposes.
Where you have consented for us to share your information, for example, with your GP or Employer, you have the right to withdraw your consent at any time. Should you wish to withdraw your consent, please speak to your VRC who will update our records.
Ingeus UK understand that it isn’t always convenient to arrange or cancel appointments during work hours. As such we provide an out of hours service, which you can contact for general advice, to cancel your appointment or to re-schedule. This service will be manned by Ingeus UK staff, as well as our Delivery Partners’ staff. All staff manning the out of hours service can gain access to your information with your permission, so that they can assist you in cancelling/rescheduling your appointments, or provide you with other information you may need. If the VRC on duty that day is not the one assigned to you, they will require your verbal consent to access your records. If you don’t feel comfortable with a VRC other than your own accessing your records, then the VRC will take a note for your own VRC to contact you to assist you with your query.
All Ingeus UK staff must complete mandatory data protection and information security training to ensure they understand their responsibilities in relation to processing your personal information. Internal and external audits are also undertaken to ensure that data protection laws are being complied with.
Ingeus UK and our Delivery Partners are required to retain your information as part of our contractual and legal obligations. We will not retain your information for any longer than is necessary. Where we are no longer required to keep your information, it will be safely and securely destroyed.
The following table provides you with information on how long we keep your information.
The GDPR grants you certain rights in regards to your personal information, and the way in which it is processed. This gives you more control over what organisations are doing with your information. These rights are:
To find out more about how we use personal data we may ask you to prove your identity whenever you make a request to exercise any of these rights. We do this to ensure we only disclose information where we know we are dealing with the right individual.
We aim to respond to all valid requests within one month. It may however take us longer if the request is particularly complicated or you have made several requests. We will always let you know if we think a response will take longer than one month.
We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are otherwise legally entitled to deal with the request in a different way.
Ingeus UK Ltd is committed to ensuring that you are always aware of what we are doing with your information and are kept abreast of any changes to the processing of your information. We do so through this Privacy Notice, which is reviewed and updated as and when required.
You have the right to ask for the personal information we hold about you. This is known as a Subject Access Request. While we will do our best to comply with your request, we may not be able to fulfil your request, for example, where information we hold has been provided to us in confidence.
When requesting your personal information you will need to include the following information:
We endeavour to ensure that the information we hold about you is always accurate. however, there may be instances where the information we hold is no longer up to date. You can ask us to rectify any information about you that is incorrect, but we may need to verify the accuracy of the information first. Please speak to your VRC so that any inaccuracies can be investigated and corrected where necessary.
You may request that certain personal information be erased from our systems if you feel that there is an underlying legal basis for this, or, where you withdraw consent.
We will not always be able to comply with your request, as there may be a legal reason that we have to keep your information. As such, each request is considered on a case-by-case basis.
You may object to us processing your personal information for the following reasons:
We will not always be able to comply with your request, such as were we have conflicting, overriding legal obligations. Each request is considered on a case-by-case basis.
You may ask us to ‘restrict’ the processing of your personal information, for example, if you object to the processing of your information, or make a complaint and we are required to investigate We can continue to use your personal data following a request for restriction where we need to use it to establish, exercise or defend legal claims, or we need to use it to protect the rights of another individual or the company.
You may ask us to provide you with a copy of the personal information that you have provided to us, and which we process electronically. The data must be provided in a ‘commonly used and machine-readable format, such as a csv file, that allows you to move, copy or transfer your data from one IT environment to another. This allows you to further use the data and to move between service providers without any loss of data.
Please note that we will not always be able to comply your request, for example, when we are legally obligated to process your data As such, each request is considered on a case-by-case basis.
We do not carry out any automated decision making or profiling.
We do not transfer any of your data outside of the EEA.
If you wish to exercise any of the above rights please email or write to:
Ingeus, 66-68 East Smithfield, Royal Pharmaceutical Building, London, E1W 1AW
Ensure that you let us have enough information to identify you, e.g.name, address, date of birth, your adviser’s details and let us know the information which you request relates to.
Please contact our Data Protection Officer if you have any questions about this privacy notice or the information we hold about you.
If you have any concerns about in the way that your information is being processed, or feel your information is not being used appropriately, please raise your concerns with the Data Protection Officer, explaining what your specific concerns are. The Data Protection Officer will then investigate your concerns you have raised.
If you remain unsatisfied after the investigation by the Data Protection Officer and their response to you, you may raise a concern with the Information Commissioner